Scenario: A developer wants to secure the Genai-Stack against external threats and ensure the confidentiality, integrity, and availability of the application. In this example, we will follow best practices such as network segmentation, strong passwords, and SSL certificates.
- Network Segmentation:
Network segmentation is the practice of dividing a network into smaller subnetworks to improve security. In the context of Docker, we can achieve network segmentation by using Docker networks.
a. Create a new Docker network:
Create a new network named genai-stack-network
using the following command:
docker network create genai-stack-network
b. Connect containers to the new network:
Connect all the containers in the Genai-Stack to the new network using the --network
flag when starting the containers. For example, for the api
container:
docker run --network genai-stack-network -d ...
- Strong Passwords:
Use strong passwords for all user accounts and services in the Genai-Stack.
a. Set a strong password for the Docker daemon:
Edit the daemon.json
file and set a strong password:
{
"authenticate": true,
"authorization-plugins": [],
"tlsverify": true,
"tlscacert": "/path/to/ca.crt",
"tlscert": "/path/to/server.crt",
"tlskey": "/path/to/server.key",
"experimental": {
"allow-nondocker": ["127.0.0.1/32"],
"log-driver": "json-file",
"log-opts": {
"max-size": "10m"
}
},
"registry": {
"insecure": false,
"index": "unix:///var/run/docker.sock",
"username": "your_username",
"password": "your_strong_password"
}
}
b. Set strong passwords for all user accounts and services in the application.
- SSL Certificates:
Use SSL certificates to secure communication between containers and external services.
a. Generate SSL certificates:
Use a certificate authority (CA) to generate SSL certificates for the Genai-Stack. For example, using Let’s Encrypt:
sudo snap install certbot --classic
sudo certbot certonly --webroot --webroot-path /var/www/html --email [email protected] --agree-tos --no-eff-email --name your_domain.com
b. Configure containers to use SSL certificates:
Configure the containers in the Genai-Stack to use the SSL certificates. For example, for the api
container, edit the nginx.conf
file:
server {
listen 80;
server_name your_domain.com;
location / {
proxy_pass http://api:5000;
proxy_ssl_certificate /path/to/server.crt;
proxy_ssl_certificate_key /path/to/server.key;
}
}
Tests:
- Verify that all containers are connected to the new network
genai-stack-network
. - Verify that all user accounts and services in the Genai-Stack have strong passwords.
- Verify that all communication between containers and external services is encrypted using SSL certificates.
References:
- Securing Docker Containers: https://sweetcode.io/securing-docker-containers
- Shifting Docker Security Left: https://snyk.io/blog/shifting-docker-security-left
- Docker Security Roundup: https://www.docker.com/blog/docker-security-roundup-news-articles-sessions
- Protecting Secrets with Docker: https://www.docker.com/blog/protecting-secrets-with-docker
- Container Security and Why It Matters: https://www.docker.com/blog/container-security-and-why-it-matters
- Automating Your Containers Security Scanning: https://www.docker.com/blog/automating-your-containers-security-scanning
- Harbor: https://goharbor.io/blog/harbor-extending-its-reach
- Container Registry: https://kubebyexample.com/resources/dev-tools/container-registry